Re: How to have a better control on how the tds use the openssl?

Sounds good!

When do you think it can be added? I am available for helping too.



Sent from Outlook
________________________________
From: Frediano Ziglio <[email protected]>
Sent: Wednesday, January 9, 2019 7:54:29 AM
To: Rick Qing Xu
Cc: FreeTDS Development Group
Subject: Re: [freetds] How to have a better control on how the tds use the openssl?

Hi,
   now I got the intention. It's a very specific case. libTDS is more
focused on working clients, not security tools. I would add a callback
for OpenSSL specifically for this purpose, maybe after tds_ssl_init
all in src/tds/login.c.
If you are using directly libTDS you can access to whatever field in
TDSSOCKET structure, probably you'll need to change/tune
conn->tls_session and conn->tls_ctx.

Frediano

Il giorno lun 7 gen 2019 alle ore 19:16 Rick Qing Xu
<[email protected]> ha scritto:
>
> Yes. We want to detect which one supports bad protocols so we can ask people to stop using them. So we want to specify which protocol to use instead of having the system to choose for us.
>
> I am not actually using dblib, ctlib and odbc. I am using libtds directly.
>
> Do you think we can add some TLS protocol parameter somewhere?
>
> -----Original Message-----
> Hi Rick,
>   SSL 3.0 ?? I think was declared insecure time ago, some people are
> disabling TLSv1.0 already.
> New OpenSSL provide a "MinProtocol" setting. Similar property would be
> good to have in libTDS too.
> About callback can be done. I would add a parameter to specify the SSL
> library kind (currently OpenSSL or GnuTLS). Which library are you
> using? dblib, ctlib or odbc?
>
> Frediano
> -----Original Message-----
> From: FreeTDS <[email protected]> On Behalf Of Rick Qing Xu via FreeTDS
> Sent: Tuesday, December 18, 2018 10:35 AM
> To: Frediano Ziglio <[email protected]>; FreeTDS Development Group <[email protected]>
> Cc: Rick Qing Xu <[email protected]>
> Subject: Re: [freetds] How to have a better control on how the tds use the openssl?
>
> The actual issue is:
>
> 1. I'd like to set the TLS version to SSL 3.0 or TLS 1.2 before the handshake, instead of let the system choose for me. Disabling TLS 1 will end up with two possibilities, TLS 1.1 and TLS 1.2. In my case, it has to be very specific, my client only wants to negotiate on TLS 1.1 or even SSLv3. It would be better if we can have a TLS version parameter in TDSLOGIN structure.
> 2. The tds lib doesn't give me chance to call SSL_set_tlsext_host_name and SSL_set_tlsext_status_type before the TLS handshake happens. If it can provide a call back mechanism, e.g., call just before it start the handshake, it would be helpful.
>
> -----Original Message-----
> From: Frediano Ziglio <[email protected]>
> Sent: Tuesday, December 18, 2018 10:19 AM
> To: FreeTDS Development Group <[email protected]>
> Cc: Rick Qing Xu <[email protected]>
> Subject: Re: [freetds] How to have a better control on how the tds use the openssl?
>
> Il giorno sab 15 dic 2018 alle ore 09:36 Rick Qing Xu via FreeTDS <[email protected]> ha scritto:
> >
> > Hi FreeTDS team,
> >
> > I am new to the TDS community and hi to everyone. I am working on a project doing in-depth detection on encryption characteristics on SQL TDS protocol. For example, by only talking to the server thru network on TDS protocol, I want to detect which TLS versions the server supports, what cipher suites are supported and what the order of it. In that case, I need to have more fine control of which TLS version is going to be used.
> >
> > Usually I need to call SSL_CTX_set_verify before the handshake starts to trust all kinds of server certificate. In addition, I'd like to use SSL_set_tlsext_host_name to control whether to use Server Name Indication extension in the handshake. Another example is I want to call SSL_set_tlsext_status_type before the handshake to ask server to send back an OCSP status response to me.
> >
> > After reading the tls.c in tds project, the tds_init_openssl() function<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FFreeTDS%2Ffreetds%2Fblob%2F513ed1a7dd5ed3be866407a2ef50d8dea3664943%2Fsrc%2Ftds%2Ftls.c%23L729&amp;data=02%7C01%7Cqinx%40microsoft.com%7Cd8ca7101d7414124439d08d6764ac525%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636826460844255366&amp;sdata=HzmVxxmPP72TpK3EAZRpjqdOIybLCP1ve0bShojXtB4%3D&amp;reserved=0> actually hardcoded the TLS method to be TLS_client_method, which is the general-purpose version-flexible SSL/TLS methods. The actual protocol version used will be negotiated to the highest version mutually supported by the client and the server. The supported protocols are TLSv1, TLSv1.1 and TLSv1.2.
> >
> > I can see that now I can control what cipher get used by setting the tds->login->openssl_ciphers to whatever I need to achieve the cipher suite ask.
> >
> > Can you give me advice on how to do it in existing code? If not in existing code, I am very happy to write some code to implement that in tds project.
> >
> > Thanks!
> >
> > Rick Qing Xu
> >
> > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgith
> > ub.com%2Fqinxgit&amp;data=02%7C01%7Cqinx%40microsoft.com%7C1d5c081f274
> > 643a3870708d665155aea%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636
> > 807539737754130&amp;sdata=EXWK4pfPIZMEa3tw8vQUiwPirpvAjxOGq8m0qG45gwg%
> > 3D&amp;reserved=0
> >
>
> Hi,
>   I think you got everything right. You can set openssl_ciphers through the "openssl ciphers" settings. In master there's an option to disable TLSv1 (which for compatibility by default is enabled).
> It would be great to have same settings for GnuTLS/OpenSSL (the "openssl ciphers" is only available with OpenSSL).
>
> Frediano
> _______________________________________________
> FreeTDS mailing list
> [email protected]
> https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.ibiblio.org%2Fmailman%2Flistinfo%2Ffreetds&amp;data=02%7C01%7Cqinx%40microsoft.com%7Cd8ca7101d7414124439d08d6764ac525%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636826460844255366&amp;sdata=Oy%2BUSTM6OmeHVWjLqSvXj%2BobdOdTJqsmvR5Rpd%2FTa0I%3D&amp;reserved=0